Supply chain · npm · High

Critical npm Package 'developer-dashboard' Compromises Systems

Threat Engine Auto-Feed · data current as of 2026-08-11

The npm package 'developer-dashboard' has been identified as malicious, leading to full system compromise upon installation. All secrets and keys on affected machines must be rotated immediately, and systems should be treated as fully compromised.

  • Package: npm / developer-dashboard
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~0/wk
  • Exposure: 60/100 (High)

What happened — Credential / secret theft

The npm package 'developer-dashboard' contains malware. Installation of this package results in a complete compromise of the host system, granting an external entity full control.

How the attack works

This is a malicious package attack where a seemingly legitimate software component is weaponized. Upon installation, the embedded malware executes, establishing persistence and exfiltrating sensitive data or enabling remote control of the compromised system.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • CI/CD pipelines that pull npm dependencies
  • Any organization with systems that have installed 'developer-dashboard'

Conditions that increase exposure

  • Unpinned dependencies that could resolve to the malicious package
  • Lack of dependency lockfiles (e.g., package-lock.json) in projects
  • Use of internal mirrors that do not vet package integrity

Blast-radius scenarios

  • An attacker gains full control over the compromised system.
  • All secrets, keys, and credentials stored on the machine are exposed and potentially exfiltrated.
  • The compromised system can be used as a pivot point for further internal network attacks.

What to do (defensive)

Detect

  • Scan dependency trees for 'developer-dashboard' in any version.
  • Monitor network traffic for unusual outbound connections from development or build systems.
  • Review system logs for unexpected process execution or file modifications post-package installation.

Contain

  • Immediately isolate any system identified with 'developer-dashboard' installed.
  • Block all network access for compromised systems except for necessary remediation tools.
  • Quarantine or delete any build artifacts or images created using compromised systems.

Remediate

  • Consider any system that installed 'developer-dashboard' as fully compromised and rebuild from a trusted image.
  • Rotate all secrets, keys, and credentials that were stored on or accessible from the compromised machine, using a different, trusted system.
  • Remove the 'developer-dashboard' package, but acknowledge that full remediation may require a complete system wipe and rebuild due to potential persistence mechanisms.

Frontier verdict — High

This is a critical severity supply-chain compromise requiring immediate isolation and credential rotation for any affected npm ecosystem users.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.